Server-side Firebase authentication